Expired SSL Certificate: Renewal and Resolution

# Check certificate expiration for a domain
echo | openssl s_client -connect tuodominio.com:443 -servername tuodominio.com 2>/dev/null \
  | openssl x509 -noout -dates

# Example output:
# notBefore=Jan  1 00:00:00 2025 GMT
# notAfter=Apr  1 00:00:00 2025 GMT   ← this is the expiration

# Or check local certificates
certbot certificates

# Renew all certificates expiring soon (within 30 days)
certbot renew

# Force renewal even if not expiring
certbot renew --force-renewal

# Renew only a specific domain
certbot certonly --force-renewal -d tuodominio.com -d www.tuodominio.com

# After renewal, reload nginx/apache
systemctl reload nginx
# or
systemctl reload apache2

# Check if Certbot timer is active
systemctl status certbot.timer

# If inactive, enable it
systemctl enable --now certbot.timer

# Verify cron is present (alternative method)
cat /etc/cron.d/certbot

# Verify port 80 responds
curl -I http://tuodominio.com

# Check firewall
ufw status | grep 80
# or
iptables -L INPUT -n | grep 80

# Display certbot configuration
cat /etc/letsencrypt/renewal/tuodominio.com.conf

# The webroot must point to nginx/apache site root
# Correct example: webroot_path = /var/www/html

server {
    listen 80;
    server_name tuodominio.com www.tuodominio.com;

    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    # Rest of HTTP traffic → HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

# Certbot with manual DNS challenge
certbot certonly --manual --preferred-challenges dns -d tuodominio.com

# Certbot will ask you to add a TXT record to DNS:
# _acme-challenge.tuodominio.com → "generated_value"
# Add the record, wait for propagation (60-120s), then press Enter

# Verify new expiration
certbot certificates

# Complete SSL test (grade A+)
# Visit: https://www.ssllabs.com/ssltest/

# Quick local test
openssl s_client -connect tuodominio.com:443 -servername tuodominio.com 2>/dev/null \
  | openssl x509 -noout -dates -issuer

# Verify timer is active
systemctl status certbot.timer

# Run a dry-run to verify it works
certbot renew --dry-run

# Correct output:
# Congratulations, all simulated renewals succeeded

crontab -e

# Check every day at 3:30, renew if needed
# and reload nginx after renewal
30 3 * * * certbot renew --quiet --post-hook "systemctl reload nginx" 2>&1 | mail -s "Certbot renew" admin@tuodominio.com

# Create hook file
cat > /etc/letsencrypt/renewal-hooks/post/reload-nginx.sh << 'EOF'
#!/bin/bash
systemctl reload nginx
EOF
chmod +x /etc/letsencrypt/renewal-hooks/post/reload-nginx.sh

# Generate self-signed certificate (valid 365 days)
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/ssl/private/selfsigned.key \
  -out /etc/ssl/certs/selfsigned.crt \
  -subj "/C=IT/ST=Italy/O=DeluxHost/CN=tuodominio.com"